問題文
An administrator needs one specific detection to stop firing on a set of machines while keeping the rest of the configuration intact. Which construct is intended for that and what is its risk?
選択肢
- Deleting the detection rule, which is the only supported way.
- Disabling the entire prevention profile for those machines, since an exception can only be defined globally for the tenant and therefore cannot be limited to a subset of endpoints in any supported configuration.
- An exception, which narrows a single detection for a defined target; written too broadly it silently removes coverage that nobody notices is gone.
- Lowering the severity of the detection so that it no longer creates an issue for any endpoint in the tenant, which leaves the detection running everywhere while nothing is raised from it.